General

  • Target

    c7ce40fdc125640d25f19b85e76bafa4_JaffaCakes118

  • Size

    1.0MB

  • MD5

    c7ce40fdc125640d25f19b85e76bafa4

  • SHA1

    5e055caf17bd968368638e4666a1e4ae56355fd9

  • SHA256

    113e0e73479cb9af16e2530d98937e36c3d5590922ae5d1a3465dfcb4e52824a

  • SHA512

    9cc071100cbeb5a145d7abe6b259d248ce8ebafc5593953439710d361ac1d95d372133a6ad8f7133ec9b708808e9c53d0ba2d6db852a09d4a36c10496638ca87

  • SSDEEP

    24576:x1q5DIYIcnXsk3NUh813ESxZnQr95IDIF2dXCP:jSXs0NX3dQr9m22M

Score
9/10
upx

Malware Config

Signatures

  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • c7ce40fdc125640d25f19b85e76bafa4_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InetLoad.dll
    .dll windows:4 windows x86 arch:x86

    24a4a671f5cc294ce3543d18a1e873cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MakeDll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsRandom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    cd53277eaa7bbb8fb5b2b678274dcb4e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/v.txt
    .vbs
  • $TEMP/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$APPDATA/$_49_
  • $_48_/$APPDATA/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$DESKTOP/$_49_
  • $_48_/$STARTMENU/$_49_
  • $_48_/$SYSDIR/game.ico
  • $_48_/$SYSDIR/taobao.ico
  • $_48_/1.html
  • $_48_/3.bat
  • $_48_/3.vbs
    .vbs
  • $_48_/game.ico
  • $_48_/qq
    .vbs
  • $_48_/qq.ico
  • $_48_/taobao.ico
  • $_48_/v.txt
    .vbs
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • oem.ini
  • ֮.exe
    .exe windows:4 windows x86 arch:x86

    529e31f77e52cbf0a3f800a64416df7b


    Code Sign

    Headers

    Imports

    Sections

  • ֮.ini